Log file d7 as attachment.
root@skywalker:/tmp# cat /etc/sssd/sssd.conf [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
[sssd] debug_level = 6 domains =nat.c.sdu.dk config_file_version = 2 services = nss, pam
[domain/nat.c.sdu.dk] debug_level = 7 ad_domain = nat.c.sdu.dk krb5_realm = NAT.C.SDU.DK realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true
best, Longina
--
On Thu, 2014-06-19 at 16:08 +0200, Longina Przybyszewska wrote:
Log file d7 as attachment.
root@skywalker:/tmp# cat /etc/sssd/sssd.conf [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
[sssd] debug_level = 6 domains =nat.c.sdu.dk config_file_version = 2 services = nss, pam
[domain/nat.c.sdu.dk] debug_level = 7 ad_domain = nat.c.sdu.dk krb5_realm = NAT.C.SDU.DK realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true
Your keytab has DOMAIN.ORG as the realm.
Your log has NAT.DOMAIN.ORG
And your sssd.conf has: NAT.C.SDU.DK
What is the realtionship between the realms?
Your keytab has DOMAIN.ORG as the realm.
Your log has NAT.DOMAIN.ORG
And your sssd.conf has: NAT.C.SDU.DK
What is the realtionship between the realms?
Sorry , I send the wrong file - this is the right one, corresponding to the log file:
cat /etc/sssd/sssd.conf [nss] debug_level = 9 filter_groups = root filter_users = root,lightdm,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd
[sssd] debug_level = 7 domains =nat.domain.org config_file_version = 2 services = nss, pam
[domain/nat.domain.org] debug_level = 7 ad_domain = nat.domain.org krb5_realm = NAT.DOMAIN.ORG realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad auth_provider = ad access_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = False use_fully_qualified_names = True fallback_homedir = /home/%d/%u # dyndns_update = true
Your keytab has DOMAIN.ORG as the realm.
The same happened to the keytab file. Here the right one, corresponding to the log file. Sorry.
Keytab name: FILE:/etc/krb5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 05/19/2014 10:36:55 host/skywalker.nat.domain.org@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/skywalker.nat.domain.org@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/skywalker.nat.domain.org@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/skywalker.nat.domain.org@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/skywalker.nat.domain.org@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/SKYWALKER@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/SKYWALKER@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/SKYWALKER@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/SKYWALKER@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 host/SKYWALKER@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG 2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG
Best, Longina
On Fri, 2014-06-20 at 07:37 +0000, Longina Przybyszewska wrote:
The same happened to the keytab file. Here the right one, corresponding to the log file.
2 05/19/2014 10:36:55 SKYWALKER$@NAT.DOMAIN.ORG
Hi And the corresponding sssd.conf?
Anyway, sssd is sending the correct stuff to nsupdate for the forward rr but the log ends there, so assuming it fails for the reverse too.
Another good way of debugging it is to perform the update by hand using nsupdate -g Do you have access to the AD dns logs? HTH Steve
sssd-users@lists.fedorahosted.org